T01 · Skill Instruction Hijacking
Error
- Location
scripts/watch-news.js:129- Finding
Untrusted Remote Article Content Is Passed Directly to the Main AI Agent
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw News Watcher
Security checks for vulnerabilities and agentic risk
Overview
This news watcher mostly matches its stated purpose, but it includes a recurring Telegram example with a fixed recipient and routes untrusted web article text through the main OpenClaw agent.
Install only if you are comfortable running a long-lived browser-based watcher that invokes your local OpenClaw agent and sends Telegram messages. Before use, replace any hardcoded Telegram recipient, prefer a constrained summarization agent instead of main, verify OPENCLAW_MJS points to your trusted OpenClaw file, and pin dependencies for reproducible installs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:44- Finding
Documentation Creates a Cron Job That Sends Notifications to a Hardcoded Telegram Recipient
- Content
View full analysis
- Remediation
View remediation
`. 3. Add a warning instructing users to verify the resolved destination before creating the cron job. 4. Search all documentation, examples, release artifacts, and prior templates for the same numeric Chat ID and remove it. 5. Advise users who may have copied the existing command to inspect their OpenClaw cron jobs, update the recipient, and remove any incorrectly configured job. 6. Add documentation tests or static checks that reject literal Telegram Chat IDs in distributable examples. ]]>
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description and all operational instructions are written in Chinese, and the example agent message also assumes Chinese usage. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language option or justification is provided here.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
场景 1：后台持续监听
bash # 在后台运行（使用 nohup 或 screen） nohup node ~/.openclaw/workspace/skills/news-watcher/scripts/watch-news.js &
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
场景 1：后台持续监听
bash # 在后台运行（使用 nohup 或 screen） nohup node ~/.openclaw/workspace/skills/news-watcher/scripts/watch-news.js &
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script trusts the OPENCLAW_MJS environment variable to select the JavaScript file executed by a child Node process. If an attacker can influence the environment or deployment configuration, they can cause arbitrary attacker-controlled code to run with the script’s privileges, turning a news watcher into an arbitrary code execution launcher.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file-level documentation describes a Playwright-based news watcher that detects updates by hash changes, but this code also summarizes article contents via an external OpenClaw agent and sends messages to Telegram. Spawning another agent process and delivering outbound messages are materially broader capabilities than passive monitoring, and no manifest is available to justify them.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The prompt explicitly requires the agent to respond in Chinese, and elsewhere the script formats timestamps with the zh-CN locale. This imposes a specific language/locale on users without offering a choice or documenting a justified region-specific constraint, which matches the policy-violation category.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script launches an external subprocess via execFileSync and takes the script path from the OPENCLAW_MJS environment variable. That means whoever controls the environment can redirect execution to an unintended local script, giving this skill code-execution capability beyond simple news monitoring and expanding the trust boundary significantly.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The safety comment is misleading because the actual control still comes from an environment variable, so the code executes whatever Node script OPENCLAW_MJS points to. Even though execFileSync avoids shell injection here, it still enables execution of attacker-selected code if the runtime environment is influenced, which can lead to local compromise or misuse of agent/message capabilities.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The prompt explicitly instructs the agent to summarize only in Chinese, and related output formatting elsewhere uses the zh-CN locale. This imposes a specific language/locale choice as a default behavior without offering the user any option to choose another language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The markdown explicitly states that the AI agent generates a Chinese summary, which imposes a specific language on output. The file does not mention any user opt-in, configurable language setting, or justification that this skill is intended only for a Chinese-language context.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The Playwright dependency is specified with a caret range (^1.40.0), which allows newer minor and patch versions to be installed over time. This weakens build reproducibility and can unexpectedly introduce vulnerable or incompatible releases, which is especially relevant for a browser automation package that downloads and executes browser components.
- Content
json "watch:panews": "node scripts/watch-news.js --site panews" }, "dependencies": { "playwright": "^1.40.0", "crypto": "^1.0.1" }, "devDependencies": {},
Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
Playwright has a referenced advisory related to downloading and installing browsers without authenticity verification, and the manifest does not pin an exact version. Because the resolved installed version is not fixed, it is not possible to confirm from this manifest alone that deployments avoid an affected release, which creates avoidable supply-chain uncertainty for a tool that fetches executable browser binaries.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The crypto dependency is also unpinned (^1.0.1), so installations may resolve to different versions over time. Even if the package is not directly malicious, floating dependency ranges increase supply-chain risk and make it harder to verify exactly what code is executed.
- Content
json }, "dependencies": { "playwright": "^1.40.0", "crypto": "^1.0.1" }, "devDependencies": {}, "engines": {
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The primary skill description is entirely in Chinese and does not indicate any language choice or opt-in for users. Under the language/locale policy rule, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified as region-specific.
- Content